Azure Identity, Access, and Security

radio_button_uncheckedshort_text1. Identity, access, and security objectives

This chapter connects Azure identity services, authentication, authorization, security architecture, encryption, key management, and cloud posture protection. The goal is to understand how these controls reinforce one another instead of treating them as isolated features.

• Differentiate Microsoft Entra ID, Microsoft Entra Domain Services, and hybrid identity.
• Compare SSO, MFA, and passwordless authentication methods.
• Explain external identities, Conditional Access, and Azure RBAC.
• Apply the Zero Trust and defense-in-depth models.
• Recognize encryption, Azure Key Vault, and Microsoft Defender for Cloud capabilities.

radio_button_uncheckedshort_text2. Microsoft Entra ID as the cloud directory

Microsoft Entra ID is Microsoft’s cloud identity and access management service. It authenticates identities for Microsoft services, third-party SaaS applications, and applications an organization builds. Customers control accounts and policies while Microsoft operates the globally available directory platform.

Connecting an on-premises Active Directory environment to Microsoft Entra ID adds cloud intelligence to identity operations. The cloud service can evaluate sign-in behavior and identify suspicious attempts, such as activity from unfamiliar devices or unexpected locations.

radio_button_uncheckedshort_text3. Who uses Microsoft Entra ID and what it provides

• Authentication capabilities include self-service password reset, MFA, banned-password lists, and smart lockout.
• Application management includes Application Proxy, SaaS integration, and the My Apps portal.
• Device management supports registration and Microsoft Intune integration.
• Device state can become a signal in Conditional Access policies.

radio_button_uncheckedshort_text4. Hybrid identity with Microsoft Entra Connect

Without integration, an on-premises directory and Microsoft Entra ID require separate identity sets. Microsoft Entra Connect synchronizes identity information between Active Directory Domain Services and Microsoft Entra ID so users receive a more consistent sign-in experience across local and cloud resources.

The hybrid design can extend SSO, MFA, and self-service password reset while retaining the local directory for workloads that still depend on it. Synchronization must be planned with clear sources of authority and protected administrative accounts.

radio_button_uncheckedshort_text5. Microsoft Entra Domain Services

Microsoft Entra Domain Services supplies managed domain join, Group Policy, LDAP, and Kerberos or NTLM authentication. Organizations can move legacy applications that cannot use modern authentication into Azure without deploying and maintaining their own cloud domain controllers.

Users and groups from the existing Microsoft Entra tenant become available to the managed domain, allowing people to use familiar credentials. This reduces migration friction for applications that expect traditional domain services.

radio_button_uncheckedshort_text6. Managed domain operation and synchronization

A managed domain starts with a unique DNS namespace. Azure deploys two Windows Server domain controllers in the selected region as a replica set and operates their configuration, updates, backups, and at-rest disk encryption.

Synchronization from Microsoft Entra ID to the managed domain is one-way. Objects created only in the managed domain do not flow back to Microsoft Entra ID. In a hybrid topology, Microsoft Entra Connect first synchronizes the on-premises directory to Microsoft Entra ID, which then supplies identities to the managed domain.

radio_button_uncheckedshort_text7. Authentication strength and single sign-on

Authentication proves the identity of a person, service, or device through credentials. Passwords, SSO, MFA, and passwordless methods offer different balances of convenience and resistance to attack. Passwordless methods generally combine strong security with a simpler user experience.

SSO lets one identity open multiple trusted applications after one sign-in. It reduces password sprawl, lockouts, resets, and lifecycle work because access remains tied to a central identity. Its security still depends on the initial authenticator: every downstream session inherits that trust.

radio_button_uncheckedshort_text8. Multifactor authentication

MFA asks for an additional proof so a stolen password alone cannot complete sign-in. Factors come from something the user knows, something the user has, or something the user is. Combining categories is stronger than requesting two versions of the same type.

Microsoft Entra multifactor authentication can request a phone call, Microsoft Authenticator notification, security key, or another registered method. Conditional Access can invoke MFA only when identity, device, location, application, or risk signals justify it.

radio_button_uncheckedshort_text9. Passwordless authentication in Microsoft Entra ID

Passwordless authentication removes the password from normal sign-in and relies on a trusted device together with a PIN or biometric gesture. After registration, the user proves possession locally; the secret is not sent to or stored by the remote service in the same way as a reusable password.

The module highlights three options: Windows Hello for Business, the Microsoft Authenticator app, and FIDO2 security keys. Each is designed to improve usability while reducing password guessing, reuse, theft, and phishing exposure.

radio_button_uncheckedshort_text10. Windows Hello, Microsoft Authenticator, and FIDO2

A FIDO2 key is registered to the user and selected as the primary method during sign-in. Because the hardware performs the cryptographic proof, there is no reusable password for an attacker to expose or guess.

radio_button_uncheckedshort_text11. External identities and the tenant boundary

An external identity belongs to a person, device, or service outside the organization’s tenant. Microsoft Entra External ID lets partners, suppliers, contractors, customers, and consumers use identities they already own while the resource tenant continues to control authorization and policy.

The identity provider performs authentication. The organization grants only approved access through Microsoft Entra ID or customer identity capabilities. External users may bring work accounts, social identities such as Google or Facebook, Microsoft accounts, or supported government-issued digital identities.

radio_button_uncheckedshort_text12. B2B collaboration, direct connect, and customer identity

Direct-connect participants are visible inside the Teams shared channel and in Teams admin reports. The capabilities can be combined according to the collaboration model and the resources being shared.

radio_button_uncheckedshort_text13. Governing guest access over time

Authorized users or administrators can invite guests from other tenants and supported social identities. Access should not remain indefinitely simply because a project once required it.

Access reviews ask guests or designated decision makers to attest whether access is still necessary. Microsoft Entra ID can provide recommendations; after the review, administrators retain, adjust, or remove access for users who no longer need it.

radio_button_uncheckedshort_text14. Conditional Access: signals, decisions, and enforcement

Microsoft Entra Conditional Access evaluates identity signals such as the user, role, location, device, application, network, and risk. During sign-in it gathers context, makes a policy decision, and enforces the result by allowing access, blocking it, or requiring an additional control such as MFA.

A routine request from a compliant device and known location might proceed without interruption. An unusual location, unmanaged device, privileged role, or risky sign-in can trigger stronger authentication or a complete block.

radio_button_uncheckedshort_text15. Common Conditional Access scenarios

• Require MFA for administrators, privileged roles, sensitive applications, or requests outside trusted networks.
• Permit a service only through approved client applications.
• Require devices to meet the organization’s management, security, and compliance standards.
• Block unknown locations, unexpected networks, risky sign-ins, or other untrusted sources.

Conditional Access supports productivity and asset protection by applying friction only where context warrants it. Policies should be tested carefully so emergency access accounts and critical workloads are not unintentionally locked out.

radio_button_uncheckedshort_text16. Azure RBAC and least privilege

Azure role-based access control (Azure RBAC) implements authorization for Azure resources. It supports least privilege by defining what a security principal may do and where. Built-in roles cover common patterns, and custom roles can represent specialized duties.

Assigning roles to groups simplifies onboarding and changes: a new engineer inherits the group’s permissions, and the same assignments can apply to newly added resources. Roles may grant broad management rights, read-only visibility, or narrowly defined actions.

radio_button_uncheckedshort_text17. Azure RBAC scopes and inheritance

For example, Owner at a management group can administer its descendant subscriptions, while Reader at a subscription can view all contained groups and resources. Scope selection is as important as role selection.

radio_button_uncheckedshort_text18. How Azure RBAC is enforced

Azure RBAC evaluates management actions that pass through Azure Resource Manager, whether initiated from the Azure portal, Azure Cloud Shell, Azure PowerShell, or the Azure CLI. It does not automatically secure an application’s own authorization model or every data-plane operation.

The model is additive and allow-based. If one assignment grants read and another grants write at the same effective scope, the principal receives both permissions. Good governance therefore reviews the combined result of all assignments and inherited scopes.

radio_button_uncheckedshort_text19. Zero Trust principles

Zero Trust starts from the assumption that breach is possible and treats every request as if it came from an uncontrolled network. It adapts to mobile work and distributed people, devices, applications, and data instead of granting trust merely because something is inside a network perimeter.

radio_button_uncheckedshort_text20. Zero Trust in practice

Traditional designs often treated managed computers on an internal network as safe and tightly restricted VPN or personal-device access. Zero Trust replaces location-based confidence with continuous, contextual evaluation.

A user on an unmanaged device and public network might receive low-risk application access, be challenged with MFA for sensitive systems, or be blocked when risk is unacceptable. The decision can change as identity, device health, workload sensitivity, or threat signals change.

radio_button_uncheckedshort_text21. Defense in depth and its layers

Defense in depth places multiple independent safeguards between an attacker and protected data. If one control fails, the next layer slows movement, reduces exposure, and creates signals that responders or automation can act on.

The model includes physical security, identity and access, perimeter, network, compute, application, and data. It is a decision framework rather than a single product and avoids relying on one defensive boundary.

radio_button_uncheckedshort_text22. Physical, identity, and perimeter defenses

• Physical security protects buildings, datacenter hardware, and assets from unauthorized physical access, theft, or loss.
• Identity and access protects accounts, limits infrastructure and change-control permissions, uses SSO and MFA, and audits sign-ins and changes.
• Perimeter controls identify network attacks, use DDoS protection to absorb large-scale denial-of-service traffic, and use firewalls to block and alert on malicious activity.

radio_button_uncheckedshort_text23. Network and compute defenses

• Network controls segment resources, deny by default, restrict inbound internet exposure, limit outbound access where appropriate, and secure on-premises connectivity.
• Compute controls secure virtual-machine access, deploy endpoint protection, remove malware, and keep operating systems and workloads patched.

Segmentation reduces the chance that compromise of one system spreads laterally to other workloads. Secure administration paths and current patches shrink the number of exploitable entry points.

radio_button_uncheckedshort_text24. Application and data defenses

• Application security begins in the development lifecycle, treats secure defaults as a design requirement, removes vulnerabilities, and stores secrets outside code.
• Data security protects confidentiality, integrity, and availability under business and regulatory requirements and uses encryption both at rest and in transit.

Attackers commonly target databases, virtual-machine disks, SaaS platforms such as Microsoft 365, and cloud storage. Data protection is therefore the center of the layered model.

radio_button_uncheckedshort_text25. Encryption at rest and in transit

Encryption transforms readable information so unauthorized parties cannot interpret it. Encryption at rest protects databases, disks, and storage accounts; encryption in transit protects data moving among services, applications, APIs, and users. A sound design uses both.

For a business application using Azure Storage and Azure SQL, customer records should remain encrypted while stored and while crossing application tiers or user connections. Encryption supports confidentiality but still depends on sound identity, authorization, and key practices.

radio_button_uncheckedshort_text26. Key and secret management with Azure Key Vault

Azure Key Vault centralizes secrets such as passwords and connection strings, encryption keys, and certificates. Applications can retrieve these values at runtime rather than embedding credentials in source code or configuration files.

• Control and audit who can view or use keys and secrets.
• Separate the duties of viewing, using, and rotating key material.
• Rotate keys and alert before expiration to preserve hygiene and avoid outages.
• Use managed identities so applications authenticate to the vault without hard-coded credentials.

radio_button_uncheckedshort_text27. Microsoft Defender for Cloud coverage

Microsoft Defender for Cloud combines cloud security posture management and workload threat protection. It monitors Azure, on-premises, hybrid, and multicloud resources, then recommends hardening actions and raises alerts when it detects threats.

• Azure-native services often require no extra deployment; data collection components can be added when deeper signals are required.
• Azure Arc extends Defender plans to non-Azure servers, while agentless CSPM can assess multicloud resources.
• Coverage includes App Service, Azure SQL, Azure Storage, virtual machines, networks, container platforms, and other workloads.
• Connected AWS environments can receive posture recommendations, Defender for Containers coverage for Amazon EKS, and Defender for Servers coverage for EC2; GCP resources can also be assessed and protected.

radio_button_uncheckedshort_text28. Assess, secure, and defend

Defender for Servers can integrate natively with Microsoft Defender for Endpoint and surface findings from Microsoft Defender Vulnerability Management. Policies can be scoped at management group, subscription, or tenant level so new resources are continuously evaluated.

Alerts identify affected resources, suggest remediation, may trigger a logic app, and can be exported. Kill-chain analysis correlates related alerts into an attack story. Advanced protections include just-in-time VM access, restrictive port policies, and adaptive application controls.

radio_button_uncheckedshort_text29. Module assessment with explained answers

radio_button_uncheckedshort_text30. Chapter summary and Copilot practice

Microsoft Entra services establish and authenticate identities; Conditional Access and Azure RBAC decide under what conditions and at what scope work can occur. Zero Trust and defense in depth guide the architecture, encryption and Azure Key Vault protect information and key material, and Microsoft Defender for Cloud continuously assesses and defends workloads.

The source recommends Microsoft Certified: Security, Compliance, and Identity Fundamentals for deeper study. It also references pay-as-you-go and a free Azure trial of up to 30 days; verify the current offer before relying on those terms.

Explore with Copilot Chat

• Create one end-to-end scenario showing how SSO, MFA, Conditional Access, and Azure RBAC reinforce a Zero Trust design.
• Compare Microsoft Entra ID, Microsoft Entra Domain Services, and external identities with practical workload examples.
• Simulate an incident and explain how encryption, key management, defense in depth, and Microsoft Defender for Cloud reduce impact.

radio_button_uncheckedshort_text31. Glossary and official references

1. Microsoft Entra ID overview
2. Microsoft Entra Domain Services overview
3. Authentication methods in Microsoft Entra ID
4. Microsoft Entra External ID overview
5. Conditional Access overview
6. Azure RBAC overview
7. Zero Trust guidance center
8. Azure Key Vault overview
9. Microsoft Defender for Cloud overview
10. AZ-900 study guide